API keys are issued directly to individual user accounts within the platform. To avoid tying access to one individual, we recommend generating the key under a dedicated service account (using a shared company mailbox) rather than a personal employee login. This way, the integration keeps working even if the person who set it up leaves or changes roles.

Setup

1. Create a dedicated service account using a shared company mailbox (e.g., service-account@yourcompany.com) rather than an individual employee's login. See Users for setup instructions.

2. Open Account Settings - click the three dots (⋮) in the top-right corner, then select Account.

3. Go to Security. API keys are managed from this section.

4. Generate a new API key, setting the expiration to Never.

5. Copy the key - it will use the prefix tb_. Store it somewhere secure.

6. Log out of the service account.

Usage

Include the key in the X-Authorization header of your requests:

X-Authorization: ApiKey tb_<your_api_key>

As a basic test, verify the key by sending the following request:

• HTTP Method: GET

• URL: https://iotpro.iotsolutions.com.mt/api/auth/user

• Header: X-Authorization: ApiKey tb_<your_api_key>

Expected Result: A 200 OK HTTP status returning your service account's email confirms the API key is active, whereas a 401 Unauthorized status indicates an invalid or malformed key.